(19) 



Europaisches Patentamt 
European Patent Office 
Office europeen des brevets 




(12) 



(ID EP 0 732 850 B1 

EUROPEAN PATENT SPECIFICATION 



(45) Date of publication and mention 
of the grant of the patent: 
23.01.2002 Bulletin 2002/04 



(51) lntCl7: H04N 7/16 



(21) Application number: 96108778.0 

(22) Date of filing: 12.04.1990 



(54) Functionally modifiable cable television converter system 

Kabelfernsehkonvertersystem mit modifizierbarer Funktion 

Systeme convertisseur pour television par cable fonctionnellement modifiable 



CD 

O 
U) 
00 

CM 
CO 
N 

o 

Q. 

LU 



(84) Designated Contracting States: 

AT BE CH DE DK FR GB IT LI NL SE 

(30) Priority: 25.05.1989 US 357174 

(43) Date of publication of application: 
18.09.1996 Bulletin 1996/38 

(62) Document number(s) of the earlier application(s) in 
accordance with Art. 76 EPC: 
90107108.4/0 399 200 

(73) Proprietor: GENERAL INSTRUMENT 
CORPORATION 
Horsham, PA 19044 (US) 

(72) Inventors: 

• Kauffman, Marc W. 
Cheltenham, Pennsylvania 19012 (US) 



• Miller, Michael R. 
Riverton, New Jersey 08077 (US) 

(74) Representative: Hoeger, Stellrecht & Partner 
Uhlandstrasse 14 c 
70182 Stuttgart (DE) 



(56) References cited: 
EP-A-0132 401 
GB-A- 2 118 750 
US-A-4 710 955 



EP-A-0187 973 
US-A- 4 623 920 



• SCHNEPERS C: 'Der Schlussel zum 
Scrambling-Problem?' FUNKSCHAU no. 5, 24 
February 1989, pages 59 - 62 



Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give 
notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in 
a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 
99(1) European Patent Convention). 



1 



EP 0 732 850 B1 



2 



Description 

[0001] The present invention relates to cable televi- 
sion apparatus, and more particularly to a converter with 
remotely modifiable functionality provided by download- 
able software. 

[0002] Cable television converters are currently avail- 
able that allow a cable system operator to remotely con- 
trol subscriber service authorizations from a central 
"headend" site. These units, which are commonly re- 
ferred to as "addressable converters", allow the cable 
system operator to control access to various premium 
services by sending a control signal from the headend 
to individual converters located at subscribers' homes. 
The authorization signals are carried on the cable tele- 
vision system, and enable individual subscribers to view 
programs that they pay an additional fee for. In opera- 
tion, the control signals typically enable the converter to 
descramble the premium channels for viewing by the 
subscriber. 

[0003] Other addressable systems currently available 
allow a limited set of operational parameters to be down- 
loaded to a converter from the headend. Such opera- 
tional parameters include, for example, information that 
maps displayed channels to tuned channels, time-out 
periods, barker channel(s), the converter output chan- 
nel, the terminal configuration, and enable/disable func- 
tions for subscriber features such as remote hand-held 
control, parental control, favorite channel recall, volume 
control, and the like. The current state of the art is to 
download configuration information for a set of features 
that have been predetermined at the time of manufac- 
ture or installation of the cable television converter. An 
example of such a converter is the Model DPV7200 ad- 
dressable converter manufactured by the Jerrold Divi- 
sion of General Instrument Corporation, Hatboro, Penn- 
sylvania, U.S.A. 

[0004] Other systems with downloadable data capa- 
bilities are also known. U.S. Patent 4,054,911 to Fletch- 
er, et al. relates to an information retrieval system capa- 
ble of capturing packets or rows of video displayable da- 
ta and/or control program instructions from data contin- 
uously transmitted in a common predetermined format. 
In the system disclosed in the patent, a user decides 
what information is to be retrieved, and takes action to 
cause a terminal to retrieve that information. Although 
a user can vary the function of the terminal by capturing 
different transmitted data, it is the user that determines 
what video displayable information is to be received, 
and how the terminal which receives this information is 
to process it. There is no disclosure or provision of 
means to enable a system operator to establish the 
functional operation of individual terminals on a multi- 
terminal network. 

[0005] In commonly owned U.S. Patent 4,71 2,239 to 
Frezza, et al. entitled "Security Arrangement for Down- 
loadable Cable Television Converters 0 , a converter ca- 
pable of downloading is disclosed that prevents a false 



booter image from, being downloaded. A false image 
could subject the system to various integrity problems, 
such as enabling an unauthorized user to view premium 
programs. In the patented system, a booter image is re- 

5 ceived on one channel and a checksum is computed 
therefrom. A valid checksum, extracted from tag data 
transmitted on a separate channel and associated with 
a scrambled program signal, is compared with the com- 
puted checksum. If the checksums do not match, a de- 

10 scrambler in the converter is precluded from descram- 
bling the program signal. The system disclosed in this 
patent downloads all of the operating software to a cable 
television converter over a dedicated "booter channel", 
to which the converter is force tuned when first turned 

15 on. Afterthe download is complete, the converter's data 
receiver is returned to the regular data channel, where 
it remains until the converter is turned off. 
[0006] EP 0 132 401 A2 discloses a system of trans- 
mitting information individually and secretly. The infor- 

20 mation to be transmitted is converted, on the transmis- 
sion side, in accordance with a predetermined algorithm 
designated by two keys and then transmitted to a receiv- 
ing side. The receiving side is supplied with at least two 
keys from the transmitting side for reproducing the 

25 transmitted information by using the two keys. One of 
the keys is frequently changed so that the algorithm is 
also changed frequently. 

[0007] US 4,71 0,955 discloses a pay-per-view cable 
television system that uses a separate telephone line as 

30 a secondary communication path. 

[0008] In the system, a subscriber terminal includes 
a tunable converter arranged to receive command data 
and to download operational parameters forwarded 
from a headend. 

35 [0009] The article "Der Schlussel zum Scrambling- 
Problem?" of Charles Scheper in Funkschau 5/1989, 
pages 59 to 62 describes an access key for services on 
a cable system . A control word for accessing one or sev- 
eral services is provided. The control word is used for 

40 ordering services. 

[0010] GB 2 1 1 8 750 A discloses a system for down- 
loading information, software modules and control data 
to selected terminals in order to provide additional func- 
tions such as unscrambling of pay-TV signals, and sub- 

45 scriber interaction signals. 

[0011] It would be advantageous to provide a method 
and system for downloading software to a remote ter- 
minal, such as a cable television converter, to allow 
modification of virtually any or all software functions of 

50 the terminal by the system operator. It would be further 
advantageous for such a method and system to enable 
the system operator to replace or modify options that 
were predetermined at the time of manufacture or instal- 
lation of the terminal. By effecting terminal modifications 

55 automatically from a headend location, such a method 
and system would eliminate the need for a technician to 
travel to a subscriber's home to modify or physically re- 
place a subscriber's terminal to effect such functional 
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modifications. 

[001 2] The present invention provides such a method 
and system for remotely modifying the functionality of a 
cable television converter or other terminal. 
[0013] In accordance with the present invention a ca- 
ble television addressable converter with remotely mod- 
ifiable functionality is provided. The converter compris- 
es frequency agile data receiver means capable of tun- 
ing to different carrier frequencies for receipt of address- 
able converter control data from a cable television head- 
end on a first channel and for receipt of operating soft- 
ware from said headend on a second channel of the dis- 
tributing cable; 

means for tuning said receiver means to said sec- 
ond channel by switching from a carrier frequency 
of the first channel to a carrier frequency of the sec- 
ond channel for receipt of the operating software in 
response to instructions contained in said address- 
able converter control data received on said first 
channel; 

memory means for storing the operating software 
received on said second channel; and 
processor means coupled to said memory means 
for accessing and executing the operating software 
received from said headend to provide at least one 
converter function. 

[0014] The converter according to one preferable em- 
bodiment includes means for receiving software down- 
loaded over a cable television network, and means cou- 
pled to the receiving means for storing the software. 
[0015] In another preferable embodiment means are 
provided for verifying the integrity of the software, and 
processor means coupled to the storing means access- 
es and executes the software to provide one or more 
converter functions dictated by the software. 
[0016] In a further preferable embodiment nonvolatile 
memory means are coupled to the processor means for 
storing default operation software for the converter. 
[0017] In an advantageous embodiment means re- 
sponsive to the verifying means cause the processor 
means to execute the default operation software, in- 
stead of the downloaded operating software, in the 
event the integrity of the software is not verified. 
[0018] Data receiving means are preferably provided 
for obtaining instructions downloaded over a cable tel- 
evision network. Downloaded software is received and 
stored by the converter only in response to specific in- 
structions received by the data receiving means. 
[0019] The software receiving means and data receiv- 
ing means advantageously comprise a frequency agile 
data receiver, together with means for selectively tuning 
the receiver, to receive instructions on a first channel 
and downloaded software on a second channel. 
[0020] Timer means return the receiver to the first 
channel if the receiver has been tuned to the second 
channel for a predetermined time period. The predeter- 



mined time period may be specified in instructions re- 
ceived on said first channel, and the length of the time 
period may be dependent on an amount of firmware to 
be received. In this manner, a converter will not become 
5 stuck on the second channel by error, and be rendered 
unable to receive further instructions on the first chan- 
nel. 

[0021] The downloaded software received and stored 
by the converter can implement a functional layout on a 

10 keyboard associated with the converter Software can 
also implement a feedback function, such as an LED 
(light-emitting-diode) display or on-screen display to as- 
sist a user in operating the converter. A control function 
for a video recorder coupled to the converter can also 

*5 be implemented by the software. Similarly, the software 
can implement a communication protocol for the con- 
verter, a descrambling technique for the converter, an 
on-screen display to be provided by the converter to a 
television coupled thereto, and/or a user interface to 

20 services provided over the cable television network. 
[0022] In a preferred embodiment of the present in- 
vention, software is transmitted in an encrypted form, 
and the instructions contain a key for decrypting the soft- 
ware. The software may also be received by the con- 

25 verter in a plurality of segments, with the instructions 
identifying the number of segments to be received for a 
complete software download. Means can be provided 
of determining if all of the segments have been validly 
received, and for receiving replacement segments if one 

30 or more segments of the software have not been validly 
received. Receipt of software can be prevented if the 
number of segments identified by the instructions is 
greater than a predetermined limit. 
[0023] A cable television headend apparatus is pro- 

35 vided for downloading operating software to an address- 
able, remotely modifiable cable television converter. 
Means are provided for transmitting addressable con- 
verter data on a first data channel of a cable television 
network. Means are provided for transmitting operating 

40 software on a second data channel of the cable televi- 
sion network. An address specific to a particular con- 
verter is provided in the addressable converter data, 
which enables specific data to be received by the con- 
verter. Instructions are provided in the specific data, to 

45 cause the converter to receive software transmitted on 
the second channel. 

[0024] The cable television headend apparatus can 
further include means for verifying that software down- 
loaded to the converter has been successfully received 

50 by the converter. Billing means maintain records of the 
cable television services each converter on the system 
is authorized to receive, and the various functions the 
converter is to have, and can assign a particular soft- 
ware package to be downloaded to a particular convert- 

55 er on the basis of the functions specified for that con- 
verter. 

[0025] A method for providing a cable television ad- 
dressable converter with functions dictated by down- 
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loaded operating software is also provided. Converter 
addressable control data is received from a remote lo- 
cation via a cable television network. A designated soft- 
ware package is captured from a set of firmware pack- 
ages carried on the cable television network, in re- 
sponse to instructions contained in the converter control 
data. The designated software package is stored in a 
memory provided in the converter, and is executed to 
provide at least one converter function dictated thereby. 
[0026] The software packages may be carried on the 
cable television network in encrypted form, and decrypt- 
ed using a key contained in the converter control data. 
In one embodiment, the converter control data is re- 
ceived on a first data channel and the software packag- 
es are captured from a second data channel on the ca- 
ble television network. The first channel is monitored to 
receive converter control data, and the second channel 
is tuned to captured software upon receipt of appropri- 
ate instructions on the first channel. Reception is re- 
turned to the first channel after the software is captured. 
If the software has not been captured within a predeter- 
mined time period, reception switches back to the first 
channel from the second channel. 
[0027] Also in accordance with the present invention, 
a remotely modifiable user terminal in the form of a cable 
television converter is provided which comprises means 
for receiving a plurality of cyclically transmitted software 
segments, the segments together comprising a soft- 
ware package. Means coupled to the receiving means 
verify each segment upon receipt thereof, and means 
are provided for storing each verified segment. A deter- 
mination is made as to whether a complete software 
package has been stored in the storing means at the 
completion of a software transmission cycle. If not, then 
reception, verification, and storage of transmitted soft- 
ware segments continues during a subsequent software 
transmission cycle. Reception of the software segments 
is terminated upon a finding that a complete software 
package has been stored. Means can further be provid- 
ed for precluding the execution of the software seg- 
ments until a complete software package has been 
stored. 

[0028] The verifying means can operate by testing a 
checksum for each software segment as it is received. 
The terminal may further comprise means for maintain- 
ing a record of the proper checksum for each segment, 
and means for periodically retesting the checksums af- 
ter a complete software package has been stored. De- 
fault operation software may be stored for the terminal, 
and executed if the checksums are not verified upon re- 
testing. The complete software package may also be 
verified after it has been stored, and the default opera- 
tion software executed if the complete software package 
is not valid. The default operation software may also be 
executed if reception of software segments is not com- 
pleted during a predetermined time period. 
[0029] A complete software package may include a 
plurality of modules. Execution of fewer than all of the 



modules may be precluded as an additional security fea- 
ture. 

[0030] The present invention provides a method and 
system for downloading software to a remote terminal, 
5 such as a cable television converter, to allow modifica- 
tion of virtually any or all software functions of the ter- 
minal by the system operator. 
[0031] It is further advantageous for such a method 
and system to enable the system operator to replace or 
10 modify options that were predetermined at the time of 
manufacture or installation of the terminal. By effecting 
terminal modifications automatically from a headend lo- 
cation, such a method and system eliminates the need 
for a technician to travel to a subscriber's home to mod- 
's ify or physically replace a subscriber's terminal to effect 
such functional modifications. 
[0032] The present invention provides a method and 
system for remotely modifying the functionality of a ca- 
ble television converter or other terminal, which is oper- 
20 able in a nominal or baseline operation mode by down- 
loading specific software to the converter. 
[0033] Further features and advantages of the 
present invention are disclosed in the following descrip- 
tion and drawings. 
25 [0034] In the drawings: 

Figure 1 is a block diagram of a functionally modifi- 
able cable television converter system in accord- 
ance with the present invention; 

30 Figure 3 is a block diagram of the pertinent ele- 
ments of a converter used in connection with the 
system of the present invention; 
Figure 3 is a flowchart illustrating steps taken by the 
headend when it receives a new software package 

35 or an assignment to download software to a con- 
verter; 

Figure 4 is a flowchart illustrating the continuous 
transmission of software over a secondary data 
channel; 

40 Figure 5 is a flowchart illustrating the steps taken 
by a converter in receiving downloaded software; 
and 

Figure 6 is a flowchart illustrating the periodic rever- 
ification of downloaded software by a converter. 

45 

[0035] Turning to Figure 1 , a cable television system 
is depicted having headend components, generally des- 
ignated 10 and subscriber components, generally des- 
ignated 12. The headend communicates with the sub- 
so • scriber via a distribution cable 36. A firmware develop- 
ment system 16 is used to create new functional soft- 
ware packages for subscriber terminals, such as con- 
verter 40. Software development system 16 may be 
physically located at the headend, but is more typically 
55 located at the facilities of a vendor which develops new 
software programs for sale to a cable system operator. 
New software packages may be transferred to an ad- 
dressable controller 14 located at the headend by mag- 
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netic tape 20 which is read by addressable controller 14, 
or by communication between the software develop- 
ment system 1 6 and addressable controller 1 4 via direct 
connection or modems 18 operating over conventional 
telephone lines. Those skilled in the art will recognize 
that other means may also be available for transferring 
software from software development system 1 6 to ad- 
dressable controller 14. 

[0036] Once software is resident in addressable con- 
troller 14, it is transmitted repeatedly over a data chan- 
nel. The data channel may be either the primary ad- 
dressable data channel provided in a conventional cable 
television network having addressable converters, or a 
separate secondary data channel. In either event, the 
data channel(s) can transmit the data on an FSK mod- 
ulated FM carrier or by any other suitable transmission 
scheme well known in the art. 
[0037] The use of a secondary chan nel for download- 
ing software to converters is illustrated in Figure 1 . Con- 
trol signals, including data such as converter addresses, 
program authorization codes, and the like is communi- 
cated from addressable controller 14 to a converter 40 
via control data modulator 26. The output of control data 
modulator 26 is coupled to distribution cable 36 via a tap 
34, and data is received therefrom by converter 40 via 
tap 38. The control data modulator transmits the data 
signals on a primary channel, and in accordance with 
the present invention, the data includes instructions to 
converter 40 which cause the converter to receive spec- 
ified software downloaded from addressable controller 
14. 

[0038] In the two channel embodiment illustrated in 
Figure 1 , the software is transmitted on a secondary 
channel by software modulator 24, coupled to the cable 
network at tap 30. Upon receipt of instructions on the 
primary channel, converter 40 switches to the second- 
ary channel for receipt of designated software. An addi- 
tional data path 28 may optionally be provided via tap 
32 for receipt of data from converter 40 by addressable 
controller 14. Such data might include, for example, a 
verification that converter 40 has successfully received 
a software package it has been instructed to receive. 
The provision of a return path 28, which provides a "two- 
way" cable communication system, is well known in the 
art. 

[0039] Billing system 22 is provided at the headend 
for maintaining accounting information relating to charg- 
es incurred by subscribers on the cable system. In ac- 
cordance with the present invention, different software 
packages downloaded by headend 10 to converter 40 
may provide different converter functions, with higher 
levels of service providing increased converter function- 
ality. Billing system 22 keeps track of the level of service 
for each subscriber, and assigns particular software 
packages to subscriber converters on the basis of con- 
verter functionality to be provided to each subscriber. 
[0040] At the subscriber location 12, a subscriber may 
have one or more video appliances 42, 44 coupled to 



the output of converter 40. For example, video appliance 
42 might be a television set, and video appliance 44 
might be a video recorder ("VCR"). In accordance with 
the present invention, software downloaded to convert- 

5 er 40 can provide functions relating to a VCR. An exam- 
ple of such a function is time controlled programming. 
This function enables the converter to be programmed 
to make channel changes at various times so that the 
VCR can record different television programs on differ- 

10 ent channels automatically and while unattended. Such 
a function can also enable "impulse pay-per-view" or- 
ders to be programmed into the converter by a subscrib- 
er, so that special premium programs can be ordered, 
when the subscriber is not home, and recorded on the 

*s subscriber's VCR for later viewing. 

[0041] Figure 2 is a block diagram illustrating the per- 
tinent components in one embodiment of a converter 40 
in accordance with the present invention. In the embod- 
iment illustrated, the converter receives addressable 

20 data on one data channel and downloaded software on 
another data channel. It is noted that both the address- 
able data and the software can also be received over a 
single data channel. Or, the software may be carried on 
some other media, such as the public telephone net- 

25 work. 

[0042] In the two channel embodiment illustrated in 
Figure 2, a microprocessor 50 receives data from cable 
36 via a frequency agile receiver 52. A transmitter 61 
and return path 62 can be provided from microprocessor 
30 50 back to addressable controller 14 in the event the 
converter is used with a two-way cable television sys- 
tem. Like receiver 52, transmitter 61 can be frequency 
agile to enable a choice of return transmission frequen- 
cies. 

35 [0043] Atuner54,underthe control of microprocessor 
50, tunes frequency agile receiver 52 to either a primary 
channel for receipt of addressable data (e.g., instruc- 
tions to capture a particular software package) or to a 
secondary channel for the receipt of software. Although 

40 a single secondary channel is described herein for pur- 
poses of illustration, it will be appreciated that any 
number of such secondary channels can be provided, 
depending on system requirements. Typically, frequen- 
cy agile receiver will be tuned to the primary channel, 

45 and will only switch to the secondary channel upon spe- 
cific instructions contained in data received on the first 
channel. In the alternate example where both address- 
able data and software are received on a single data 
channel, frequency agile receiver 52 and tuner 54 can 

50 be replaced with a fixed frequency data receiver. 

[0044] The provision of a dedicated secondary data 
channel as illustrated in Figure 2 is advantageous. By 
keeping software data off of the primary channel, the 
data throughput load on this channel is reduced. 

55 [0045] In the two channel embodiment, software data 
is broadcast cyclically on the second channel, by ad- 
dressable controller 14 at the headend. In a preferred 
embodiment, a plurality of different software packages 
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are broadcast on the secondary channel, each package 
providing different converter functions or combinations 
of functions. Upon receipt of instructions on the primary 
channel, microprocessor 50 will cause tuner54 to switch 
receiver 52 to the secondary channel for receipt of a 
designated software package. 
[0046] Various memory devices are coupled to micro- 
processor 50, including read only memory ("ROM") 65, 
operating random access memory ("RAM") 58, and non- 
volatile RAM 60 . ROM 56 contains a program that allows 
converter 40 to retrieve and execute a downloaded soft- 
ware package. Upon receiving the proper command 
from the addressable controller, the converter aborts 
any downloaded package currently being executed, ac- 
cesses the appropriate data channel for receipt of a des- 
ignated software package to be downloaded, and re- 
ceives and loads the software into nonvolatile firmware 
RAM 60. 

[0047] ROM 56 also contains default operation soft- 
ware, which is used to restore the converter to a nominal 
tor "baseline" operation if a bad software download oc- 
curs. Such a nominal or "baseline" operation provides 
the basic functions to a converter, so that watching of at 
least one television program is possible. These basic 
functions in particular are predetermined options. As ex- 
plained below, if an error is detected in the receipt of 
downloaded software, or if the software is found to be 
invalid, the converter is forced to execute only the de- 
fault operation software stored in ROM 56. 
[0048] A timer 64 is associated with microprocessor 
50 to provide a time-out feature that prevents the con- 
verter from getting stuck on the secondary channel, in 
the event there is a problem receiving specified soft- 
ware. 

[0049] When billing system 22 assigns a new soft- 
ware package to a particular converter 40, addressable 
controller 1 4 is commanded to transmit instructions to 
the converter. The instructions are received by micro- 
processor 50, and include an identifier specifying which 
■ software package to receive, where to find the software 
package (i.e., on the primary or a specified secondary 
channel), a predetermined time limit defining how long 
the converter should attempt to receive the software be- 
fore aborting, a key to use in decrypting the data in the 
event it is encrypted, and the maximum segment 
number to be loaded (indicating how many segments 
are included in the software package to be received). 
While the software is being received, timer 64 counts 
down thetime-out period specified in the download com- 
mand. If the timer expires, microprocessor 50 aborts the 
download, and returns to the original data channel. The 
time-out period specified in the download command can 
be varied depending on the amount of software to be 
downloaded. 

[0050] Timer 64 is also used in connection with a self- 
check that is periodically performed by the converter to 
ensure that the software has not changed since the last 
authorized download. This self-check is a security fea- 



ture to guard against infiltration of the converter by a 
"software pirate" who attempts to download unauthor- 
ized software to the converter, in an effort to steal serv- 
ices from the cable system. 

s [0051] In accordance with the self-check procedure, 
timer 64 retests the checksum for each of the software 
segments at regular intervals after the software has 
been downloaded. In the event a checksum is found to 
be invalid, microprocessor 50 restores the converter to 

10 baseline operation by executing the default operation 
software contained in ROM 56. 
[0052] Converter 40 contains various other compo- 
nents with functions that can be modified by download- 
ed software. For example, a light-emitting-diode ("LED") 

15 display or other display 66 may be provided on the con- 
verter to give a user feedback concerning converter op- 
erations. Pressing a button on the converter, or its re- 
mote control unit, can cause an LED to light, verifying 
that the button has been pressed or that a function to 

20 be activated by the button has occurred. Such a feed- 
back function is useful to assist a user in operating the,: 
converter. 

[0053] The converter also includes a keyboard 68, the 
functional layout of which can be defined and/or modi- 

25 fied by software downloaded to the converter. Keyboard 
68 may be physically on the converter box, on a remote 
hand-held unit for the converter, or a separate keyboard 
can be provided in both places. 
[0054] Converter 40 also includes a descrambler 70 

30 for descrambling premium programs received via the 
cable television network. Various descrambling tech- 
niques are well known in the art, and different tech- 
niques can be implemented by downloading different 
software to the converter. 

35 [0055] Another feature that can be provided by con- 
verter 40 is the display of information on a user's televi- 
sion set. On-screen display driver 72 is provided for this 
purpose. An example of such a display is the channel 
number tuned to, or the current time. In addition, on- 

40 screen displays can be used to distribute messages 
from the cable system operator, e.g., "your account is 
past due; please send us a check". An electronic mail, 
or "E-mail" feature can also be provided, enabling a sub- 
scriber to send and receive text messages on his tele- 

45 vision (or other display) via the cable system. The im- 
plementation and/or modification of on-screen displays 
can be provided by software downloaded to the convert- 
er. 

[0056] In order to provide a measure of protection 
50 against illegal use of the software download feature, the 
software is downloaded to the converter in an encrypted 
form. The data is decrypted at the converter by a de- 
cryption module 74. A decryption key is transmitted to 
the converter from the headend as part of the address- 
55 able data instructions that command the converterto re- 
ceive a particular software package. Encryption and de- 
cryption schemes are well known in the art. Examples 
of such schemes are provided in commonly owned U. 
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S. Patent Nos. 4,638,356 of William A. Frezza, entitled 
"Apparatus and Method for Restricting Access to a 
Communication Network", and 4,710,955 of Marc W. 
Kauffman, entitled "Cable Television System with Two- 
Way Telephone Communication Path". 
[0057] A viewership monitor 76 can be provided in ac- 
cordance with the present invention to enable a cable 
system operator to determine what programs and serv- 
ices a subscriber has received using each converter, 
and/or to retrieve a list of the functions which have been 
used on each converter. Viewership monitor 76 will 
monitor the operation of the converter, and store perti- 
nent data relating thereto. By addressing an appropriate 
command to the converter, the cable system operator 
will be able to upload the data to the headend for anal- 
ysis. 

[00581 Other functions that can be implemented by 
software downloaded to the converter include commu- 
nication protocols for the converter, and user interfaces 
to services provided over the cable television network. 
For example, a user may be provided with the capability 
to order pay-per-view programs on an impulse basis. 
The procedure for ordering such programs can be mod- 
ified through downloadable software. Utility meter read- 
ing can also be provided, by adding an asynchronous 
data port to the converter and controlling the retrieval of 
utility data via downloaded software. 
[0059] A flowchart illustrating a routine which can be 
used by the addressable controller in connection with 
the receipt and downloading of software is provided in 
Figure 3. The routine begins at box 80, and at box 82 a 
determination is made as to whether a software update 
has been received from the software development sys- 
tem. If so, control passes to box 84 and the newsoftware 
data is encrypted. At box 86, the encrypted data is load- 
ed into the secondary data channel transmitter (soft- 
ware modulator 24) and continuously transmitted on the 
secondary channel together with other software pack- 
ages that can be provided to converters on the system. 
[0060] At box 88, a determination is made as to 
whether a new software package assignment has been 
made by billing system 22. If so, addressable controller 
1 4 sends an appropriate command on the primary chan- 
nel (control data modulator 26) as indicated at box 90. 
The command is addressed to the particular converter 
that is to receive the software, and identifies the channel 
the software is to be received from, identifies the soft- 
ware package to be received, provides the decryption 
key necessary to decrypt the software data, identifies 
the number of segments which make up the complete 
software package, and sets forth the time-out parameter 
defining the maximum time the converter should stay 
tuned to the secondary channel for receipt of the down- 
loaded software. 

[0061] The converter receives the software in fixed 
length "segments", and specific converter models will 
have specific maximum segment numbers determining 
the actual maximum size of allowable software down- 



loads. In a preferred embodiment, the maximum seg- 
ment number is a hard-coded parameter. Should an at- 
tempt be made to download software that exceeds the 
maximum size, the download will be rejected by the con- 

5 verter. In operation, the converter will ignore the down- 
load command and will not switch to the secondary 
channel if the transmitted maximum segment number 
parameter exceeds the internal converter maximum. 
[0062] At box 92 of Figure 3, a determination is made 

10 as to whether an abort of a download is required. This 
would be the case, for example, if the addressable con- 
troller detects a problem with an attempted download. 
In the event an abort is required, an abort command is 
transmitted over the secondary channel as indicated at 

15 box 94. The converter will then switch back to the pri- 
mary channel, execute the default operation software to 
return to a baseline operation, and await a subsequent 
command from the addressable controller via the prima- 
ry data channel. At box 96, the routine of Figure 3 ends. 

20 it will be appreciated by those skilled in the art that the 
routine of Figure 3 is called on a periodic basis (or can 
be a continuous loop) to enable new software to be re- 
ceived from the software development system and to 
download software packages to converters at the com- 

25 mand of billing system 22. 

[0063] Figure 4 illustrates a routine that the address- 
able controller can use to continuously transmit 
firmware data over the secondary channel. The routine 
commences at box 100, and at box 102 data is trans- 

30 mitted over the secondary channel. At box 1 04, a deter- 
mination is made as to whether the last segment of a 
software package has been transmitted. If not, transmis- 
sion of the remaining segments continues as indicated 
at box 1 02. Once the last segment has been transmitted, 

35 control passes to box 1 06 and the addressable control- 
ler transmits a check/execute command to the converter 
(s) that was to receive the software package. The check/ 
execute command includes the software package 
number that was to be received, and a check pattern. 

40 The check pattern is used to verify the entire download 
prior to execution. When a check/execute command is 
received, the converter checks to see if all required seg- 
ments have been received, and that the check pattern 
downloaded matches the pattern calculated from the ac- 

45 tual downloaded data. If all checks are valid, the con- 
verter permits execution of the downloaded code, and 
returns to the primary data channel. After the check/ex- 
ecute command is sent at box 1 06 of Figure 4, control 
returns to box 102, and continuous transmission of the 

50 data proceeds over the secondary channel, 

[0064] Figure 5 is a flowchart illustrating the capture 
of downloaded software by a converter. The routine be- 
gins at box 110, and control passes to box 112 where a 
determination is made as to whether a software capture 

55 command has been sent to the converter. If not, the con- 
verter continuously wafts for such a command to be re- 
ceived at box 112. 

[0065] Once a software capture command is re- 



13 



EP 0 732 850 B1 



14 



ceived, control passes from box 112 to box 120 for the 
actual capture of the software. At the same time, an an- 
cillary time-out process commences as indicated at box- 
es 114, 116, and 118. A timer counts down the time-out 
period specified in the software capture command. If the 
time-out period expires before the specified software 
package has been successfully captured, as deter- 
mined at box 114, control passes to box 116 where the 
download is aborted and the converter returns to the pri- 
mary data channel. As indicated at box 1 1 8, the default 
operation software is executed so that the converter can 
operate in a baseline mode until the appropriate soft- 
ware package can be properly downloaded. 
[0066] As indicated at box 120, before a software 
download commences, a determination is made as to 
whether the number of segments contained in the soft- 
ware package to be downloaded is within bounds. In 
other words, as noted above, the maximum segment 
number of the software package to be downloaded must 
not exceed the maximum size allowable for the convert- 
er, if the number of segments exceeds the number al- 
lowed by the converter, the software capture command 
is ignored and control returns to box 1 1 2. Otherwise, the 
software capture proceeds and at box 122, the convert- 
er switches to the secondary channel (i.e., the channel 
on which the firmware is downloaded). At box 124, the 
segments comprising the software package are re- 
ceived, software is continuously broadcast on the sec- 
ondary data channel in small (e.g., 32 byte) encrypted 
packets. A converter that has been commanded to ac- 
cept a new package tunes to the appropriate channel 
and loads each packet that has the proper version iden- 
tifier. While loading, the converter keeps track of each 
segment successfully loaded in an internal segment bit 
map. As indicated at box 126, a determination is made 
as to whether a segment has been successfully loaded. 
This is accomplished by computing a checksum for each 
segment, and comparing the checksum with one down- 
loaded with the firmware segment. If the checksums 
match, the converter decrypts the data contained in the 
segment, stores the data, and sets an appropriate bit in 
a software segment bit map as indicated at box 130. In 
storing the data, if prior software has been stored in the 
converter, the appropriate segment of the prior software 
is overwritten with the newly received data. 
[0067] If it is determined at box 126 that a segment 
has not been properly loaded (i.e., the computed and 
downloaded checksums do not match), the converter ig- 
nores the segment and proceeds directly to box 132. At 
box 132, a determination is made as to whether the last 
segment in a software package has been received. If 
not, control returns to box 124 and the procedure con- 
tinues until all segments are received. 
[0068] After the last segment has been received, con- 
trol passes to box 134 which determines if the bit map 
created at box 1 30 is complete. If the bit map is not com- 
plete, it means that one or more segments were not 
property loaded and an attempt to receive these seg- 



ments will be made during the next transmission cycle 
of the software. In this event, control returns from box 
132 to box 124 where an attempt to receive the entire 
firmware package will again be made. 

s [0069] As is evident from the flowchart of Figure 5, an 
incorrectly received segment will not overwrite a previ- 
ously correctly received segment. All correctly received 
segments, however, will overwrite previously received 
segments. In this manner, even if there are errors in the 

10 transmission of certain segments during a download cy- 
cle, all of the segments should be correctly received af- 
ter the completion of several complete transmission cy- 
cles of a software package. 

[0070] Once all of the segments have been properly 
15 received, the bit map will be complete, and box 1 34 will 
pass control to box 1 36. Box 1 36 responds to the check/ 
execute command transmitted by the addressable con- 
troller at box 106 in Figure 4. When the check/execute 
command is received, the converter checks to see if all 
20 required segments have been received and that the 
check pattern downloaded matches a pattern^alculated 
from the actual downloaded data (i.e., the complete soft- 
ware package). If the patterns do not match, control re- 
turns to box 124 and additional attempts are made to 
25 receive the software as long as a time-out (box 1 1 4) has 
not occurred. 

[0071 ] If the entire software package is determined to 
be valid at box 136, control passes to box 138 and an 
execution bit is set permitting the software to be execut- 

30 ed. As an additional level of protection against a soft- 
ware pirate, software contained in the converter's ROM 
(ROM 56 - Figure 2) can periodically determine if all of 
the functional modules contained in the software pack- 
age are being executed, and if not, subsequent execu- 

35 tion of the software can be precluded by turning off a 
separate, special execution bit maintained by the con- 
verter 

[0072] At box 140, the downloading of a software 
package is complete, and the converter returns to the 
40 primary data channel. The routine ends at box 142. 
[0073] The software download process is a destruc- 
tive one. Once a converter receives the command to ac- 
cept a new package, the old downloaded software (if 
any) is effectively deleted and cannot be executed. In 
45 the preferred embodiment, partial downloads are not 
supported, and an entire package must be sent. This 
further frustrates a software pirate's efforts, and allows 
a software download to be nullified by sending the com- 
mand to accept a package immediately followed by 
50 sending the command to return to the primary data 
channel. 

[0074] The various commands sent by the addressa- 
ble controller to support the firmware download process 
are: 

55 

Accept Software Download 
Return to Primary Channel 
Disallow Downloaded Execution 



50 
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Load Software Segment 
Check/Execute Software 
Send Software Check Pattern 

[0075] The "Accept Software Download" command is 
used to initiate the software download process. It may 
be sent to one individual converter or globally to a set 
of converters that understand a group address. The ad- 
dressed converter(s) prepares to accept the package 
number, on the appropriate channel, using the given 
firmware decryption key and maximum segment 
number The software download time-out value is also 
given. Upon reception of this command, the converter 
goes into Its software download mode, in which it must- 
not execute any downloaded code. 
[0076] The "Return to Primary Channel" command is 
used to force a converter to return to the primary data 
channel. This command may also be sent in a specific 
format to an individual converter, or in group format to 
a set of converters. All converters receiving this com- 
mand abort the current software download, clear their 
software segment bit maps, and exit the software down- 
load mode. 

[0077] The "Disallow Downloaded Execution" com- 
mand explicitly disallows the execution of any down- 
loaded software. It may be sent in the specific or group 
format. All converters receiving this command abort ex- 
ecution of any downloaded software, dear their soft- 
ware segment bit maps, exit software download mode, 
and execute the default operation software contained in 
ROM for baseline operation. Another method of prohib- 
iting downloaded software from being executed is to 
send an "Accept software Download" command imme- 
diately followed by a "Return to Primary Channel" com- 
mand. 

[0078] The "Load Software Segment" command is 
used to download the individual segments of a software 
package. All converters receiving this command, if in 
software reception mode, overwrite the appropriate seg- 
ment of software by the received data. Before actually 
overwriting the code, the converter checks to see if the 
package number matches the commanded package 
number, and calculates the segment check pattern from 
the received data. If the check pattern is correct, the seg- 
ment data is decrypted, the appropriate prior segment 
is overwritten with the new segment, and the appropri- 
ate bit in the software segment bit map is set. 
[0079] The "Check/Execute Software" command is 
used to terminate the software download process. All 
converters receiving this command respond only if the 
package number matches the one sent originally in the 
"Accept Software Download" command, and If in soft- 
ware reception mode. If so, the converter checks to see 
if all of the necessary segments of software have been 
correctly received. If they have been , the package check 
pattern is calculated and tested. If the check pattern is 
bad, the converter ignores the command. If the check 
pattern is good, the converter permits execution of the 



newly downloaded package, switches back to the pri- 
mary data stream, exits the software download mode, 
and clears its software download segment bit map. 
[0080] The "Send Software Check Pattern" command 
5 is used to verify the software download process. A con- 
verter receiving this command responds only if it is not 
in software reception mode. In this event, the converter 
reports the check pattern of the appropriate segment or 
of the entire package. This verification scheme is only 
10 available on a two-way cable system. 

[0081] Figure 6 illustrates a periodic self-check rou- 
tine used by the converter to test the validity of down- 
loaded software to ensure that it has not changed since 
the last download. This self-check is performed by the 
15 converter itself, and no addressable controller com- 
mand is required to initiate it. The routine begins at box 
150. At box 152, a clock runs to keep track of time. At 
box 154, a determination is made as to whether a pre- 
determined time interval has passed. If not, the routine 
20 loops back to box 152 and the process continues until 
the time interval has run. Then, box -154 passes control 
to box 156 to commence the periodic selfrcheck. 
[0082] At box 156, the first segment of the software 
package is tested by computing its checksum. At box 
25 158, a determination is made as to whether the check- 
sum is the proper checksum for that segment. If not, 
control passes to box 1 60 and the default operation soft- 
ware is executed to return the converter to baseline op- 
eration. If the checksum for the segment is proper, con- 
30 trol passes to box 1 62, which determines if the segment 
just tested is the last segment in the software package. 
If not, the routine loops back to box 1 56 so that all of the 
segments in the software package can be tested. 
[0083] Once the last segment has been tested, con- 
35 trol is passed from box 1 62 to box 1 64 where the clock 
is reset. Control then loops back to box 152 and the 
process continues, so that the self-check will be period- 
ically performed at the time interval dictated by the time- 
out determination function at box 154. 
40 [0084] It will now be appreciated that the present in- 
vention provides a method and apparatus for remotely 
modifying the functionality of a terminal, such as a cable 
television converter. Terminal functions are dictated by 
downloaded software. The software is transmitted in 
45 small segments to reduce the likelihood and severity of 
transmission errors, and to reduce the temporary buff- 
ering requirements within the terminal. Each section of 
a software package is transmitted with an identifier in- 
dicating which segment it is, and which software pack- 
so age it is part of, A multiplicity of software packages may 
be carried on a single system, with different terminals in 
the system accepting and executing different packages 
as specified by the system headend. 
[0085] The software is stored at the terminal in non- 
55 volatile memory, such as RAM with a battery backup. 
Various safeguards are provided to ensure that the soft- 
ware is accurately downloaded, and to frustrate the ef- 
forts of a software pirate attempting to infiltrate the sys- 
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tern. 

[0086] Although the present invention has been de- 
scribed in connection with a preferred embodiment, it 
will be appreciated that many modifications and adap- 
tations may be made thereto without departing from the 
scope of the invention as set forth in the following claims. 

Claims 

1 . A cable television addresable converter with re- 
motely modifiable functionality comprising: 

frequency agile data receiver means (52) capa- 
ble of tuning to different carrier frequencies for 
receipt of addressable converter control data 
from a cable television headend (10) on a first 
channel of a distribution cable (36) and for re- 
ceipt of operating software from said headend 
on a second channel of the distribution cable 
(36); 

means (54) fortuning said receiver means (52) 
to said second channel by switching from a car- 
rier frequency of the first channel to a carrier 
frequency of the second channel for receipt of 
the operating software in response to instruc- 
tions contained in said addressable converter 
control data received on said first channel; 
memory means (60) for storing the operating 
software received on said second channel; and 
processor means (50) coupled to said memory 
means (60) for accessing and executing the op- 
erating software received from said headend 
(10) to provide at least one converter function. 

2. The converter of claim 1 further comprising: 

means for verifying the integrity of said operat- 
ing software received on said second channel; 
and 

means for causing said processor means to ex- 
ecute default operation software instead of said 
operating software in the event the integrity of 
said operating software is not verified. 

3. The converter as defined in one of claims 1 or 2 fur- 
ther comprising: 

timer means for returning said receiver to said 
first channel if it has been tuned to said second 
channel for a predetermined time period. 

4. The converter of claim 3 wherein said predeter- 
mined time period is specified in instructions con- 
tained in said addressable converter control data 
received on said first channel. 

5. The converter as defined in one of claims 3 or 4 
wherein the length of said predetermined time pe- 



riod is dependent on the amount of said operating 
software to be received. 

6. The converter as defined in one of claims 1 to 5 
5 wherein said operating software implements a func- 
tional layout of a keyboard associated with said con- 
verter. 

7. The converter as defined in one of claims 1 to 6 
10 wherein said operating software implements a feed- 
back function to assist a user in operating the con- 
verter 

8. The converter as defined in one of claims 1 to 7 
*5 wherein said operating software implements a con- 
trol function for a video recorder coupled to the con- 
verter. 

9. The converter as defined in one of claims 1 to 8 
20 wherein said operating software implements a com- 
munication protocol forthe-converter. 

10. The converter as defined in one of claims 1 to 9 
wherein said operating software implements a de- 

25 scrambling technique for the converter. 

11. The converter as defined in one of claims 1 to 10 
wherein said operating software implements an on- 
screen display to be provided by the converter to a 

30 television coupled thereto. 

12. The converter as defined in one of claims 1 to 11 
wherein said operating software implements a user 
interface to services provided over a cable televi- 

35 sion network. 

13. The converter as defined in one of claims 1 to 12 
wherein said operating software implements an 
electronic mail capability to be provided over a ca- 

40 ble television network. 

14. The converter as defined in one of claims 1 to 13 
wherein said operating software implements a 
viewership monitoring function. 

45 

15. The converter as defined in one of claims 1 to 14 
further comprising: 

means for enabling the downloaded operating 
software to be received and stored by the converter 
so only in response to specific instructions received by 
said data receiving means. 

16. The converter as defined in one of claims 1 to 15 
wherein said operating software is transmitted in an 

55 encrypted form, and said instructions contain a key 
for decrypting the operating software. 

17. The converter as defined in one of claims 1 to 16 
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wherein said operating software is received in a plu- 
rality of segments, and said instructions identify the 
number of segments to be received for a complete 
operating software download. 

18. The converter of claim 1 7 further comprising: 

means for determining if all of said segments 
have been validly received; and 
means for receiving replacement segments if 
one or more segments of said operating soft- 
ware has not been validly received. 

19. The converter as defined in one of claims 1 7 or 18 
further comprising: 

means for preventing the receipt of said oper- 
ating software if the number of segments identified 
by said instructions is greater than a predetermined 
limit. 

20. Cable television headend apparatus for download- 
ing operating software to an addressable remotely 
modifiable cable television converter (40), compris- 
ing: 

means (26) for transmitting addressable con- 
verter control data on a carrier frequency of a 
first data channel of a distribution cable (36) of 
a cable television network; 
means (24) for transmitting operating software 
onacarrierfrequencyofasecond data channel 
of the distribution cable (36) of said cable tele- 
vision network: 

means (14) forproviding an address in said ad- 
dressable converter control data specific to a 
particular converter (40) coupled to the net- 
work, said address enabling specific data to be 
received by said converter (40) on said first da- 
ta channel; and 

means (50) for providing instructions in said 
specific data, said instructions causing said 
converter to switch from said carrier frequency 
of said first channel to said carrier frequency of 
said second channel to receive the operating 
software transmitted on said second channel. 

21. The apparatus of claim 20 further comprising: 

means for verifying that operating software 
downloaded to said converter has been successful- 
ly received by the converter. 

22. The apparatus as defined in one of claims 20 or 21 
further comprising: 

billing means for maintaining a record of func- 
tions said converter is authorized to have, and for 
assigning a particular operating software package 
to be downloaded to said converter on the basis of 
the authorized functions. 



23. A method for providing a cable television address- 
able converter with functions dictated by download- 
ed operating software, comprising the steps of: 

5 receiving addressable converter control data 

from a remote headend location on a first chan- 
nel of a distribution cable; 
switching data receiver means (52) from a car- 
rier frequency of said first channel to a carrier 

10 frequency of a second channel in response to 

instructions contained in said addressable con- 
verter control data; 

capturing a designated operating software 
package, from a set of operating software pack- 
15 ages transmitted from said remote headend lo- 

cation on said second channel of the distribu- 
tion cable, in response to instructions con- 
tained in said addressable converter control da- 
ta; 

20 storing the designated operating software 

package received on said second channel in a 
memory provided in said converter; and 
executing said operating software to provide at 
least one converter function dictated thereby. 

25 

24. The method of claim 23 wherein the operating soft- 
ware packages are transmitted in encrypted form, 
said method comprising the further step of: 

decrypting the captured operating software 
30 using a key contained in said converter control data. 

25. The method of claim 23 or 24 comprising the further 
steps of: 

3 $ monitoring said first channel to receive said ad- 

dressable converter control data; 
switching to said second channel to capture 
said operating software upon receipt of appro- 
priate instructions on said first channel; and 

40 switching back to said first channel after said 

operating software is captured. 

26. The method of claim 25 comprising the further step 
of: 

4 $ switching back to said first channel from said 

second channel upon the expiration of a predeter- 
mined time period, if the operating software has not 
been captured within said time period. 

50. 27. The method of claim 26 comprising the further step 
of: 

deriving said time period from said addressa- 
ble converter control data received on said first 
channel. 

55 

28. The method as defined in one of claims 26 or 27 
wherein the length of the time period is dependent 
on the amount of said operating software to be cap- 
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tured. 

29. A remotely modifiable user terminal in the form of a 
cable television converter according to one of the 
claims 1 to 19, said user terminal comprising: 

means for receiving a plurality of cyclically 
transmitted operating software segments to- 
gether forming an operating software package; 
means coupled to said receiving means for ver- 
ifying each segment upon receipt thereof; 
. means responsive to said verifying means for 
storing each verified segment; 
means for determining if a complete operating 
software package has been stored in said stor- 
ing means at the completion of an operating 
software transmission cycle; 
means responsive to said determining means 
for continuing to receive, verify, and store trans- 
mitted operating software segments during a 
subsequent operating software transmission 
cycle if said determining means finds that a 
complete operating software package has not 
been stored; and 

means for terminating the reception of said op- 
erating software segments upon a finding by 
said determining means that a complete oper- 
ating software package has been stored. 

30. The terminal of claim 29 further comprising: 

means for precluding the execution of said op- 
erating software segments until a complete operat- 
ing software package has been stored. 

31. The terminal as defined in one of claims 29 or 30 
wherein said verifying means tests a checksum for 
each operating software segment, said terminal fur- 
ther comprising: 

means for maintaining a record of the proper 
checksum for each segment; and 
means for periodically retesting said check- 
sums after a complete operating software pack- 
age has been stored. 

32. The terminal of claim 31 further comprising: 

means for storing default operation software for 
said terminal; and 

means for executing said default operation soft- 
ware if said checksums are not verified upon 
retesting. 

33. The terminal as defined in one of claims 29 to 32 
further comprising: 

means for validating the complete operating 
software package after it has been stored. 



34. The terminal of claim 33 further comprising: 

means for storing default operation software for 
said terminal; and 
s means for executing said default operation soft- 

ware if said validating means determines that 
the complete operating software package is not 
valid. 

10 35. The terminal as defined in one of claims 29 to 34 
further comprising: 

timer means for terminating the reception of 
operating software segments after a predetermined 
time period. 

15 

36. The terminal of claim 35 further comprising: 

means forstoring default operation software for 
said terminal; and 
20 means for executing said default operation soft- 

ware if said timer?means terminates the recep- 
tion of said operating software segments. 

37. The terminal as defined in one of claims 29 to 36 
25 wherein the execution of said operating software 

provides at least one converter function of the cable 
television converter. 

38. The terminal as defined in one of claims 29 to 37 
30 wherein a complete operating software package in- 
cludes a plurality of modules, said terminal further 
comprising: 

means for precluding the execution of down- 
loaded operating software if fewer then all of the 
35 modules are available for execution. 

39. Method for providing downloaded operating soft- 
ware to an addressable remotely modifiable cable 
television converter by a cable television headend 

40 apparatus, comprising the steps of: 

transmitting addressable converter control data 
on a carrier frequency of a first data channel of 
a distribution cable of a cable television net- 
45 work; 

transmitting said operating software on a carri- 
er frequency of a second data channel of the 
distribution cable of said cable television net- 
work; 

so providing an address in said addressable con- 

verter control data specific to a particular con- 
verter coupled to the network, said address en- 
abling specific data to be received by said con- 
verter on said first data channel; and 

55 providing instructions in said specific data, said 

instructions causing said converter to switch 
from said carrier frequency of said first channel 
to said carrier frequency of said second chan- 
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nel to receive said operating software transmit- 
ted on said second channel. 



PatentansprUche 

1. Ein adressierbarer Kabelfernsehkonvertermitfern- 
modifizierbarer Funktion, bestehend aus: 

^ einem frequenzagilen Datenempfangsmittel 
(52) , das sich auf verschiedene Tragerfrequen- 
zen zum Empfang addressierbarer Konverter- 
steuerdaten von einer Kabetfemsehkopfstelle 
(10) auf einem ersten Kanal eines Verteilerka- 
bels (36) und zum Empfang von Betriebssoft- 
ware von der Kopfstelle auf einem zweiten Ka- 
nal des Verteilerkabels (36) abstimmen kann; 

einem Mittel (54) zum Abstimmen des Emp- 
f angsmittels (52) auf einen zweiten Kanal durch 
das Schalten von einer Tragerfrequenz des er- 
sten Kanals auf eine Tragerfrequenz des zwei- 
ten Kanals zum Empfang der Betriebssoftware 
als Antwort auf in den addressierbaren Konver- 
tersteuerdaten, welche auf dem ersten Kanal 
empfangen werden, enthaltene Befehle; 

einem Speichermittel (60) zum Speichern der 
auf dem zweiten Kanal empfangenen Betriebs- 
software; und 

einem Prozessormittel (50), das mit dem Spei- 
chermittel (60) verbunden ist, zum Zugreifen 
auf und Ausfuhren der von der Kopfstelle (10) 
empfangenen Betriebssoftware, urn minde- 
stens eine Konverterfunktion bereitzustellen. 

2. Konverter gemaB Anspruch 1 , ferner bestehend 
aus: 

einem Mittel zum Feststellen der Integritat der 
auf dem zweiten Kanal empfangenen Betriebs- 
software; und 

einem Mittel zum Bewirken, da(3 das Prozes- 
sormittel anstatt der Betriebssoftware eine 
Standardfunktionssoftware ausfuhrt, wenn die 
Integritat der Betriebssoftware nichtfestgestellt 
wird. 

3. Konverter gemaB einem der Anspruche 1 oder 2, 
ferner bestehend aus: 

einem Zeitgebermittel zum Zurucksteilen des 
Empfangers auf den ersten Kanal, wenn eruber ei- 
nen vorgegebenen Zeitraum auf den zweiten Kanal 
abgestimmt gewesen ist. 

4. Konverter gemaB Anspruch 3, wobei der vorgege- 
bene Zeitraum in Befehlen, die in den addressier- 



baren Konvertersteuerdaten, welche auf dem er- 
sten Kanal empfangen werden, enthalten sind, spe- 
zifiziert wird. 

5 5, Konverter gemaB einem der Anspruche 3 oder 4, 
wobei die Lange des vorgegebenen Zeitraums von 
dem Umfang der zu empfangenden Betriebssoft- 
ware abhangig ist. 

io 6. Konverter gemaB einem der Anspruche 1 bis 5, wo- 
bei die Betriebssoftware eine Funktionskonfigurati- 
on einer mit dem Konverter verbundenen Tastatur 
impiementiert. 

15 7. Konverter gemaB einem der Anspruche 1 bis 6, wo- 
bei die Betriebssoftware eine Ruckkopplungsfunk- 
tion impiementiert, urn einem Verwender beim Be- 
tatigen des Konverters zu helfen. 

20 8. Konverter gemaB einem der Anspruche 1 bis 7, wo- 
bei die Betriebssoftware eine Steuerungsfunktion 
fur einen mit dem Konverter verbundenen Videore- 
korder impiementiert. 

25 9. Konverter gemaB einem der Anspruche 1 bis 8, wo- 
bei die Betriebssoftware ein Kommunikationsproto- 
koll fur den Konverter impiementiert. 

10. Konverter gemaB einem der Anspruche 1 bis 9, wo- 
30 bei die Betriebssoftware ein Entwurfelverfahren fur 

den Konverter impiementiert. 

11. Konverter gemaB einem der Anspruche 1 bis 10, 
wobei die Betriebssoftware eine Anzeige auf dem 

35 Bildschirm impiementiert, die von dem Konverter an 
einen damit verbundenen Fernseher bereitzustel- 
len ist. 

12. Konverter gemaB einem der Anspruche 1 bis 11, 
40 wobei die Betriebssoftware eine Benutzeroberfla- 

che zu uber ein Kabelfemsehnetzwerk bereitge- 
stellten Dienstleistungen impiementiert. 

13. Konverter gemaB einem der Anspruche 1 bis 12, 
45 wobei die Betriebssoftware eine Fahigkeit fur elek- 

tronischen Briefdienst impiementiert, die uber ein 
Kabelfemsehnetzwerk bereitzustellen ist. 

14. Konverter gemaB einem der Anspruche 1 bis 13, 
50 wobei die Betriebssoftware eine Zuschaueruberwa- 

chungsfunktion impiementiert. 

15. Konverter gemaB einem der Anspruche 1 oder 14, 
ferner bestehend aus: 



einem Mittel zum Ermoglichen, daB die herun- 
tergeladene Betriebssoftware nur als Antwort 
auf spezifische vom Datenempfangsmittel 



35 



25 



EP0 732 850 B1 



26 



empfangene Befehle vom Konverter empfan- 
gen und gespeichert werden. 

16. Konverter gemaB einem der Anspruche 1 bis 15, 
wobei die Betriebssoftware in verschliisselter Form 
ubertragen wird und die Befehle einen Schlussel 
enthalten, urn die Betriebssoftware zu entschlus- 
seln. 

17. Konverter gemaB einem der Anspruche 1 bis 16, 
wobei die Betriebssoftware in einer Vieizahl von 
Segmenten empfangen wird und die Befehle die 
Anzahl der fur eine vollstandige Herunterladung der 
Betriebssoftware zu empfangenden Segmente 
identifizieren. 

18. Konverter gemaB Anspruch 17, femer bestehend 
aus: 

einem Mittel zum Bestimmen, ob alle Segmen- 
te richtig empfangen worden sind; und 

einem Mittel zum Empfangen von Ersatzseg- 
menten, wenn etn oder mehrere Segmente der 
Betriebssoftware nicht richtig empfangen wor- 
den sind. 

19. Konverter gemaB einem der Anspruche 1 7 oder 1 8, 
femer bestehend aus: 

einem Mittel zum Verhindern des Empfangs der 
Betriebssoftware, wenn die Anzahl der von den 
Befehlen identifizierten Segmente groBer als 
eine vorgegebene Grenze ist. 

20. Kabelfemsehkopfstellenvorrichtung zum Herunter- 
laden von Betriebssoftware auf einen adressierba- 
ren, fernmodifizierbaren Kabelfernsehkonverter 
(40), bestehend aus: 

einem Mittel (26) zum Ubertragen addressier- 
barer Konvertersteuerdaten auf einer Trager- 
frequenz eines ersten Datenkanals eines Ver- 
teilerkabels (36) eines Kabelfernsehnetzwerks; 

einem Mittel (24) zum Ubertragen von Betriebs- 
software auf einer Tragerfrequenz eines zwei- 
ten Datenkanals des Verteilerkabels (36) des 
Kabelfernsehnetzwerks; 

einem Mittel (14) zum Bereitstellen einer 
Adresse in den adressierbaren Konvertersteu- 
erdaten, die spezifisch fur einen einzelnen 
adressierbaren, mit dem Netzwerk verbunde- 
nen Konverter (40) ist, wobei die Adresse er- 
moglicht, daB spezifische Daten vom Konverter 
(40) auf dem ersten Datenkanal empfangen 
werden; und 



einem Mittel (50) zum Bereitstellen von Befeh- 
len in den spezifischen Daten, wobei die Befeh- 
le bewirken, daB der Konverter von der Trager- 
frequenz des ersten Kanals auf die Tragerfre- 
5 quenz des zweiten Kanals schaltet, urn die auf 

dem zweiten Kanal ubertragene Betriebssoft- 
ware zu empfangen. 

21 . Vorrichtung gemaB Anspruch 20, femer bestehend 
10 aus: 

einem Mittel zum Feststellen, daB auf den Kon- 
verter heruntergeladene Betriebssoftware er- 
folgreich vom Konverter empfangen worden ist. 

15 

22. Vorrichtung gemaB einem der Anspruche 20 oder 
21 , femer bestehend aus: 

einem Fakturierungsmittel zum Festhalten der 
20 Funktionen, die der Konverter aufweisen darf, 

und^umZuordnen eines besonderen Betriebs- 
software-Pakets, das auf der Basis der berech- 
tigten Funktionen auf den Konverter herunter- 
zuladen ist. 

25 

23. Ein Verfahren zum Bereitstellen eines adressierba- 
ren Kabelfernsehkonverters mit von der herunter- 
geladenen Betriebssoftware diktierten Funktionen, 
bestehend aus folgenden Schritten: 

30 

Empfangen adressierbarer Konvertersteuer- 
daten von einer abgesetzten Kopfstellenort auf 
einem ersten Kanal eines Verteilerkabels; 

35 Schalten des Datenempfangsmittels (52) von 

einer Tragerfrequenz des ersten Kanals auf ei- 
ne Tragerfrequenz des zweiten Kanals als Ant- 
wort auf in den addressierbaren Konvertersteu- 
erdaten enthaltene Befehle; 

40 - .V7.\ 

Festhalten eines bestimmten Betriebssoft- 
ware-Pakets aus einem Satz von Betriebssoft- 
ware-Paketen, welche von dem abgesetzten 
Kopfstellenort auf dem zweiten Kanal des Ver- 
45 teilerkabels ubertragen werden, in Antwort auf 

in den addressierbaren Konvertersteuerdaten 
enthaltene Befehle; 

Speichern des bestimmten, auf dem zweiten 
so Kanel empfangenen Betriebssoftware-Pakets 

in einem in dem Konverter bereitgestellten 
Speicher; und 

Ausfuhren der Betriebssoftware, um minde- 
55 stens eine dadurch diktierte Konverterfunktion 

bereitzustellen. 

24. Verfahren gemaB Anspruch 23, wobei die Betriebs- 
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software-Pakete in verschlusselter Form ubertra- 
gen werden, wobei das Verfahren aus folgendem 
Schritt besteht: 

Entschlusseln der festgehaltene Betriebssoft- 
ware unter Verwendung eines in den Konver- 
tersteuerdaten enthaltenen Schlussels. 

25. Verfahren gemaB Anspruch 23 Oder 24, ferner be- 
stehend aus folgenden Schritten: 

Uberwachen des ersten Kanals, urn addres- 
sierbare Konvertersteuerdaten zu empfangen; 

Schalten auf den zweiten Kanal, urn Betriebs- 
software beim Empfang geeigneter Befehle auf 
dem ersten Kanal festzuhalten; und 

Zuriickschalten auf den ersten Kanal, nachdem 
die Betriebssoftware festgehalten worden ist. 

26. Verfahren gemaB Anspruch 25, ferner bestehend 
aus folgendem Schritt: 

Zuruckschaften von dem zweiten Kanal auf den 
ersten Kanal nach Ablauf eines vorgegebenen 
Zeitraums, wenn die Betriebssoftware inner- 
halb des Zeitraums nicht festgehalten worden 
ist. 

27. Verfahren gemaB Anspruch 26, ferner bestehend 
aus folgendem Schritt: 

Ermitteln des Zeitraums aus den auf dem er- 
sten Kanal empfangenen adressierbaren Kon- 
vertersteuerdaten. 

28. Verfahren gemaB einem der Anspruche 26 oder27, 
wobei die Lange des Zeitraums von der Menge der 
festzuhaltenden Betriebssoftware abhangig ist. 

29. Eine fernmodifizierbare Benutzerstation in der 
Form eines Kabelfernsehkonverters gemaB einem 
der Anspriiche 1 bis 19, wobei die Benutzerstation 
aus folgendem besteht: 

einem Mittel zum Empfangen einer Vielzahl 
von zyklisch ubertragenen Betriebssoftware- 
segmenten, die gemeinsam ein Betriebssoft- 
ware-Paketbilden; 

einem mit dem Empfangsmittel verbundenen 
Mittel zum Feststellen jedes Segments bei des- 
sen Empfang; 

einem Mittel, das zum Speichem jedes festge- 
stellten Segments auf das Feststellungsmrttel 
anspricht; 
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einem Mittel zum Bestimmen, ob ein vollstan- 
diges Betriebssoftware-Paket in dem Speicher- 
mittel beim AbschluB eines Betriebssoftware- 
Ubertragungszyklus gespeichert worden ist; 

einem Mittel, das auf das Bestimmungsmittel 
anspricht, zum weiteren Empfangen, Feststel- 
len und Speichern ubertragener Betriebssoft- 
ware-Segmente wahrend eines nachfolgenden 
Betriebssoftware-Ubertragungszyklus, wenn 
das Bestimmungsmittel erkennt, daB ein voil- 
standiges Betriebssoftware-Paket nicht ge- 
speichert worden ist; und 

einem Mittel zum Beenden des Empfangs der 
Betriebssoftware-Segmente, wenn das Be- 
stimmungsmittel erkennt, daB ein voilstandiges 
Betriebssoftware-Paket gespeichert worden 
ist. 

30. StatiorvgemaB Anspruch 29, ferner bestehend aus: 

einem Mittel zum Verhindern des Ausfuhrens 
der Betriebssoftware-Segmente bis ein voil- 
standiges Betriebssoftware-Paket gespeichert 
wird. 

31. Station gemaB einem der Anspruche 29 Oder 30, 
wobei das Feststellungsmittel eine Prufsumme fur 
jedes Betriebssoftware-Segment pruft, wobei die 
Station ferner aus folgendem besteht: 

einem Mittel zum Festhalten derrichtigen Pruf- 
summe fur jedes Segment; und 

einem Mittel zum periodischen Wiederprufen 
der Prufsummen nachdem ein voilstandiges 
Betriebssoftware-Paket gespeichert worden 
ist. 

32. Station gemaB Anspruch 31 , ferner bestehend aus: 

einem Mittel zum Speichern von Standardfunk- 
tionssoftware fur jede Station; und 

einem Mittel zum Ausfuhren derStandardfunk- 
tionssoftware, wenn die Prufsummen beim 
Wiederprufen nicht festgestellt werden. 



50 33. Station gemaB einem der Anspruche 29 bis 32, fer- 
ner bestehend aus: 

einem Mittel zum Feststellen des vollstandigen 
Betriebssoftware-Pakets nachdem es gespei- 
55 chert worden ist. 

34. Station gemaB Anspruch 33, ferner bestehend aus: 
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Konverter ist, wobei die Adresse ermoglicht, 
daB spezif ische Daten vom Konverter auf dem 
ersten Datenkanai empfangen werden; und 
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einem Mittel zum Speichern von Standardfunk- 
tionssoftware fur die Station; und 

einem Mittel zum Ausfuhren der Standardfunk- 
tionssoftware, wenn das Feststellungsmittel s 
bestimmt, daB das voltstandige Betriebssoft- 
ware-Paket nicht gultig ist. 



35. Station gemaB einem der Anspruche 29 bis 34, fer- 
ner bestehend aus: 

einem Zeitgebermittel zum Beenden des Emp- 
fangs von Betriebssoftware-Segmenten nach 
einem vorgegebenen Zertraum. 

36. Station gemaB Anspruch 35, femer bestehend aus: 

einem Mittel zum Speichern von Standardfunk- 
tionssoftware fur jede Station; und 

einem Mittel zum Ausfuhren der Standardfunk- 
tionssoftware, wenn das Zeitgebermittel das 
Empfangen der Betriebssoftware-Segmente 
beendet. 

37. Station gemaB einem der Anspruche 29 bis 36, wo- 
bei das Ausfuhren der Betriebssoftware minde- 
stens eine Konverterfunktion des Kabelfernsehkon- 
verters bereitstellt. 

38. Station gemaB einem der Anspruche 29 bis 37, wo- 
bei ein volistandiges Betriebssoftware-Paket eine 
Vielzahl von Funktionseinheiten beinhaltet, wobei 
die Station ferner aus folgendem besteht: 

einem Mittel zum Verhindern des Ausfuhrens 
heruntergeladener Betriebssoftware, wenn we- 
niger als alle Funktionseinheiten zum Ausfuh- 
ren vorhanden sind. 

39. Ein Verfahren zum Bereitstellen heruntergeladener 
Betriebssoftware fureinen adressierbaren, fernmo- 
difizierbaren Kabelfernsehkonverterdurch eine Ka- 
belfernsehkopfstellenvorrichtung, bestehend aus 
folgenden Schritten: 

Obertragen addressierbarer Konvertersteuer- 
daten auf einer Tragerfrequenz eines ersten 
Datenkanals eines Verteilerkabels eines Ka- 
belfernsehnetzwerks; 

Obertragen der Betriebssoftware auf einer Tra- 
gerfrequenz eines zweiten Datenkanals des 
Verteilerkabels des Kabelfernsehnetzwerks; 

Bereitstellen einer Adresse in den adressierba- 
ren Konvertersteuerdaten, die spezifisch furei- 
nen einzelnen mit dem Netzwerk verbundenen 



Bereitstellen von Befehlen in den spezif ischen 
Daten, wobei die Befehle bewirken, daB der 
Konverter von der Tragerfrequenz des ersten 
Kanals auf die Tragerfrequenz des zweiten Ka- 
nals schaltet, urn die auf dem zweiten Kanal 
ubertragene Betriebssoftware zu empfangen. 



Revendications 

*s 1. Unconvertisseuradressablede television par cable 
& fonctionnalite modifiable a distance comprenant : 

un moyen recepteur de donnSes agile en fre- 
q uence (52) capable de s'accorder sur differen- 
20 tes frequences porteuses pour recevoir des 

^ donnees de controle de convertisseur adressa- 
ble depuis une tete de r6seau de television par 
cable (10) sur une premiere voie de transmis- 
sion d'un cable de distribution (36) et pour re- 
25 cevoir un logiciel d'exploitation depuis ladite te- 

te de reseau sur une seconde voie de transmis- 
sion du c§ble de distribution (36) ; 

un moyen (54) pour accorder ledit moyen re- 
30 cepteur (52) sur ladite seconde voie de trans- 

mission en commutant d'une frequence porteu- 
se de la premiere voie de transmission sur une 
frequence porteuse de la seconde voie de 
transmission pour recevoir le logiciel d'exploi- 
35 tation en reponse a des instructions contenues 

dans lesdites donnees de controle de conver- 
tisseur adressable regues sur ladite premiere 
voie de transmission ; 

un moyen memoire (60) pour memoriser le lo- 
giciel d'exploitation regu sur ladite seconde 
voie de transmission ; et 

un moyen processeur (50) couple audit moyen 
^5 memoire (60) pour acceder au logiciel d'exploi- 

tation regu depuis ladite tete de reseau (1 0) et 
I'executer afin de fournir au moins une fonction 
de convertisseur 

so 2. Le convertisseur de la revendication 1 comprenant 
de plus : 

un moyen pour verifier Tintegrite dudit logiciel 
d'exploitation re$u sur ladite seconde voie de 
55 transmission ; et 

un moyen pour amener ledit moyen processeur 
k ex6cuter le logiciel d'exploitation par defaut k 
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la place dudit logiciel Sexploitation au cas ou 
I'integrite dudit logiciel d'exploitation ne se se- 
rait pas verifiee. 

3. Le convertisseur tel que defini dans I'une des re- 
vendications 1 ou 2 comprenant de plus : 

un moyen minuteur pour renvoyer ledit recep- 
teur sur ladite premiere voie de transmission s'il a 
ete accorde sur ladite seconde voie de transmission 
pendant un laps de temps predetermine. 

4. Le convertisseur de la revendication 3 dans lequel 
ledit laps de temps predetermine est specifie dans 
des instructions contenues dans lesdites donnees 
de controle de convertisseur adressable revues sur 
ladite premiere voie de transmission. 

5: Le convertisseur tel que defini dans I'une des re- 
vendicattons 3 ou 4 dans lequel la duree dudit laps 
de temps predetermine est f onction de la taille dudit 
logiciel d'exploitation devant etre regu. 

6. Le convertisseur tel que defini dans I'une des re- 
vendications 1 a 5 dans lequel ledit logiciel d'exploi- 
tation implemente une disposition fonctionnelle des 
touches de clavier associee audit convertisseur. 

7. Le convertisseur tel que defini dans I'une des re- 
vendications 1 a 6 dans lequel ledit logiciel d'exploi- 
tation implemente une fonction de retroaction pour 
aider un utilisateur a faire fonctionner le convertis- 
seur. 

8. Le convertisseur tel que defini dans I'une des re- 
vendications 1 a 7 dans lequel ledit logiciel d'exploi- 
tation implemente une fonction de controle pour un 
magnetoscope couple au convertisseur. 

9. Le convertisseur tel que defini dans I'une des re- 
vendications 1 a 8 dans lequel ledit logiciel d'exploi- 
tation implemente un protocole de communication 
pour le convertisseur. 

10. Le convertisseur tel que defini dans Tune des re- 
vendications 1 & 9 dans lequel ledit logiciel d'exploi- 
tation implemente une technique de desembrouilla- 
ge pour le convertisseur. 

11. Le convertisseur tel que defini dans I'une des re- 
vendications 1 a 10 dans lequel ledit logiciel d'ex- 
ploitation implemente un affichage a I'ecran devant 
etre fourni par le convertisseur a une television a 
laquelle il est couple. 

12. Le convertisseur tel que defini dans Tune des re- 
vendications 1 a 11 dans lequel ledit logiciel d'ex- 
ploitation implemente une interface utilisateur pour 
des services fournis sur un reseau de television par 



cable. 

13. Le convertisseur tel que defini dans i'une des re- 
vendications 1 a 12 dans lequel ledit logiciel d'ex- 

5 ploitation implemente une fonction courrier eiectro- 
nique devant etre foumie sur un reseau de televi- 
sion par cable. 

14. Le convertisseur tel que defini dans I'une des re- 
10 vendications 1 a 13 dans lequel ledit logiciel d'ex- 
ploitation implemente une fonction de surveillance 
de I'audience. 

15. Le convertisseur tel que defini dans I'une des re- 
*5 vendications 1 k 14 comprenant de plus : 

un moyen pour autoriser la reception et la me- 
morisation, parte convertisseur, du logiciel d'exploi- 
tation teiecharge uniquement en reponse a des ins- 
tructions specifiques revues par ledit moyen r6cep- 
20 teur de donnees. 

16. - Le convertisseur tel que defini dans I'une des re- 

vendications 1 a 15 dans lequel ledit logiciel d'ex- 
ploitation est transmis sous une forme encryptee et 
25 lesdites instructions contiennent une cie pour 6e- 
crypter le logiciel d'exploitation. 

17. Le convertisseur tel que defini dans i'une des re- 
vendications 1 & 16 dans lequel ledit logiciel d'ex- 

30 ploitation est regu en une pluralite de segments et 
lesdites instructions identified le nombre de seg- 
ments devant etre regus pour un teiechargement du 
logiciel d'exploitation au complet. 

35 18. Le convertisseur de la revendication 17 compre- 
nant de plus : 

un moyen pour determiner si lesdits segments 
ont tous ete re$us de fagon valide ; et 

40 r . 

un moyen pour recevoir des segments de rem- 
placement si un segment, ou plus, dudit logiciel 
d'exploitation n'a pas ete regu de fagon valide. 

45 19. Le convertisseur tel que defini dans I'une des re- 
vendicattons 17 ou 18 comprenant de plus : 

un moyen pour empecher la reception dudit 
logiciel d'exploitation si le nombre de segments 
identifies par lesdites instructions est superieur a 

50 une limite predeterminee. 

20. Appareil pour tete de reseau de television par cable 
pour teiecharger un logiciel d'exploitation sur un 
convertisseur adressable de television par cable 
55 modifiable k distance (40), comprenant : 

un moyen (26) pour transmettre des donnees 
de controle de convertisseur adressable sur 
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une frequence porteuse d'une premiere voie de 
transmission de donnees d'un cable de distri- 
bution (36) d'un reseau de television par cable ; 

un moyen (24) pour transmettre un logiciel s 
Sexploitation sur une frequence porteuse 
d'une seconde voie de transmission de don- 
nees du cable de distribution (36) dudit reseau 
de television par cable ; 

10 

un moyen (14) pourfoumir, dans lesdites don- 
nees de controle de convertisseur adressable, 
une adresse specifique a un convertisseur par- 
ticulier (40) couple au reseau, ladite adresse 
permettant audit convertisseur (40) de recevoir 1$ 
des donnees sp6cifiques sur ladite premiere 
voie de transmission de donnees ; et 

un moyen (50) pour foumir des instructions 
dans lesdites donnees specifiques, lesdites 20 
instructions amenantledit convertisseur & com- v 
muter de ladite frequence porteuse de ladite 
premiere voie de transmission sur ladite fr6- . 
quence porteuse de ladite seconde voie de 
transmission afin de recevoir le logiciel d'ex- 25 
ploitation transmis sur ladite seconde voie de 
transmission. 



adressable ; 

a capturer un progiciel Sexploitation designe 
dans un ensemble de progiciels d'exploitation 
transmis depuis ledit emplacement de tete de 
reseau a distance sur ladite seconde voie de 
transmission du cable de distribution en r6pon- 
se & des instructions contenues dans lesdites 
donnees de controle de convertisseur 
adressable ; 

a memoriser le progiciel d'exploitation designe 
recu sur ladite seconde voie de transmission 
dans une memoire dont est muni ledit 
convertisseur ; et 

a executer ledit logiciel d'exploitation afin de 
fournir au moins une fonction de convertisseur 
dictee de ce fait. 

24. Le proc6de de la revendication 23 dans lequel les 
progiciels d'exploitation sont transmis sous forme 
encryptee, ledit procede comprenant I'etape sup- 
plemental consistant a : 

decrypter le logiciel d'exploitation capture en 
utilisant une cie contenue dans lesdites donnees de 
controle de convertisseur. 



21. L'appareil de la revendication 20 comprenant de 
plus : 

un moyen pour verifier que le logiciel d'exploi- 
tation telecharge sur ledit convertisseur a ete regu 
avec succes par le convertisseur. 

22. L'appareil tel que d6fini dans I'une des revendica- 
tions 20 ou 21 comprenant de plus : 

un moyen de listage pour tenir un 6tat des 
fonctions que ledit convertisseur est autorise a avoir 
et pour attribuer, sur la base des fonctions autori- 
sees, un progiciel d'exploitation particulier devant 
etre teiecharge sur ledit convertisseur. 

23. Un procede pour fournir a un convertisseur adres- 
sable de television par c&ble des fonctions dictees 
par le logiciel d'exploitation teiecharge, comprenant 
les etapes consistant : 

a recevoir des donnees de controle de conver- 
tisseur adressable depuis un emplacement de 
tete de reseau a distance sur une premiere voie 
de transmission d'un cable de distribution ; 



25. Le procede de la revendication 23 ou de la reven- 
30 dication 24 comprenant les Stapes supplementai- 

res consistant : 

a surveiller ladite premiere voie de transmis- 
sion afin de recevoir lesdites donnees de con- 
35 trole de convertisseur adressable ; 

a commuter sur ladite seconde voie de trans- 
mission, apres reception destructions appro- 
prtees sur ladite premiere voie de transmission, 
40 afin de capturer ledit logiciel d'exploitation ; et 

a commuter en retour sur ladite premiere voie 
de transmission une 

45 fois ledit logiciel d'exploitation capture. 

26. Le procede de la revendication 25 comprenant I'eta- 
pe supplemental consistant a : 

commuter en retour de ladite seconde voie de 
50 transmission sur ladite premiere voie de transmis- 
sion apres expiration d'un laps de temps predeter- 
mine si le logiciel d'exploitation n'a pas ete capture 
dans ledit laps de temps. 

27. Le procede de la revendication 26 comprenant I'eta- 
pe suppiementaire consistant a : 

trouver ledit laps de temps dans lesdites don- 
nees de controle de convertisseur adressable re- 



a commuter (edit moyen recepteur de donnees 
(52) d'une frequence porteuse de ladite pre- 
miere voie de transmission sur une frequence 55 
porteuse d'une seconde voie de transmission 
en reponse a des instructions contenues dans 
lesdites donnees de controle de convertisseur 
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9ues sur ladite premiere voie de transmission. 

28. Le proc^de tel que defini dans I'une des revendica- 
tions 26 ou 27 dans lequel la dur6e du laps de temps 
est fonction de la taille dudit logiciel d'exploitation 
devant etre capture. 

29. Un terminal utilisateur modifiable a distance sous la 
forme d'un convertisseur de television par cable se- 
lon Tune des revendications 1 a 19, ledit terminal 
utilisateur comprenant : 

un moyen pour recevoir une plurality de seg- 
ments de logiciel d'exploitation transmis de fa- 
gon cyclique formant ensemble un progiciel 
d'exploitation ; 

un moyen couple audit moyen r6cepteur pour 
verifier chaque segment aprfcs sa reception ; 

un moyen sensible audit moyen verificateur 
pour memoriser chaque segment verifie ; - 

un moyen pour determiner si un progiciel d'ex- 
ploitation au complet a ete memorise dans ledit 
moyen de memorisation k la fin d'un cycle de 
transmission de logiciel d'exploitation ; 

un moyen sensible audit moyen de determina- 
tion pour continuer de recevoir, verifier et m6- 
moriser des segments de logiciel d'exploitation 
transmis durant un cycle de transmission de lo- 
giciel d'exploitation ulterieur si ledit moyen de 
determination constate qu'un progiciel d'exploi- 
tation au complet n'a pas ete memorise ; et 

un moyen pour interrompre la reception desdits 
segments de logiciel d'exploitation apres cons- 
tat, par ledit moyen de determination, qu'un 
progiciel d'exploitation au complet a 6t6 memo- 
rise. 

30. Le terminal de la revendication 29 comprenant de 
plus : 

un moyen pour prevenir I'execution desdits 
segments de logiciel d'exploitation tant qu'un progi- 
ciel d'exploitation au complet n'a pas ete memorise. 

31. Le terminal tel que defini dans Tune des revendica- 
tions 29 ou 30 dans lequel ledit moyen verificateur 
examine, pour chaque segment de logiciel d'exploi- 
tation, une somme de controle, ledit terminal com- 
prenant de plus : 



progiciel d'exploitation au complet a 6te memo- 
rise. 

32. Le terminal de la revendication 31 comprenant de 
5 plus : 

un moyen pour memoriser un logiciel d'exploi- 
tation par defaut pour ledit terminal ; et 

10 un moyen pour executer ledit logiciel d'exploi- 

tation par defaut si lesdites sommes de controle 
ne se sont pas verif iees apres avoir ete re-exa- 
minees. 

« 33. Le terminal tel que defini dans I'une des revendica- 
tions 29 a 32 comprenant de plus : 

un moyen pour valider le progiciel d'exploita- 
tion au complet une fois qu'il a ete memorise. 

20 34. Le terminal de la revendication 33 comprenant de 
plus : 

un moyen pour memoriser un logiciel d'exploi- 
tation par defaut pour ledit terminal ; et 

un moyen pour executer ledit logiciel d'exploi- 
tation par defaut si ledit moyen de validation de- 
termine que le progiciel d'exploitation au com- 
plet n'est pas valide. 

35. Le terminal tel que defini dans Tune des revendica- 
tions 29 a 34 comprenant de plus : 

un moyen minuteur pour interrompre la recep- 
tion de segments de logiciel d'exploitation une 
fois un laps de temps predetermine ecouie. 

36. Le terminal de la revendication 35 comprenant de 
plus : 

un moyen pour m6moriser un logiciel d'exploi- 
tation par defaut pour ledit terminal ; et 

un moyen pour executer ledit logiciel d'exploi- 
tation par defaut si ledit moyen minuteur inter- 
rompt la reception desdits segments de logiciel 
d'exploitation. 

37. Le terminal tel que defini dans I'une des revendica- 
tions 29 k 36 dans lequel I'execution dudit logiciel 
d'exploitation foumit au moins une fonction de con- 
vertisseur du convertisseur de television par cable. 

38. Le terminal tel que defini dans I'une des revendica- 
tions 29 k 37 dans lequel un progiciel d'exploitation 
au complet comporte une pluralite de modules, ledit 
terminal comprenant de plus : 

un moyen pour prevenir ('execution d'un logi- 



un moyen pour tenir un etat de la somme de ss 
controle propre pour chaque segment ; et 
un moyen pour re-examiner periodiquement 
lesdites sommes de controle une fois qu'un 
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ciet Sexploitation tel6charge si les modules ne sont 
pas tous disponibles pour ('execution. 

39. Procede pour fournir un logiciel d'exploitation tele- 
charge k un convertisseur adressable de television s 
par cSble modifiable k distance grace k un appareil 
de tete de reseau de television par c&ble, compre- 
nant les etapes consistant : 

a transmettre des donnees de controle de con- 10 
vertisseur adressable sur une frequence por- 
teuse d'une premiere voie de transmission de 
donnees d'un cable de distribution d'un reseau 
de television par cable ; 

15 

k transmettre ledit logiciel d'exploitation sur une 
frequence porteuse d'une seconde voie de 
transmission de donnees du cable de distribu- 
tion dudit reseau de television par cable ; 

20 

a fournir, dans lesdites donriees de controle de 
convertisseur adressable, une adresse specif i- 
que a un convertisseur particulier couple au re- 
seau, ladite adresse permettant audit conver- 
tisseur de recevoir des donnees specifiques 25 
sur ladite premiere voie de transmission de 
donnees ; et 

a fournir des instructions dans lesdites don- 
nees specifiques, lesdites instructions ame- 30 
nant ledit convertisseur a commuter de ladite 
frequence porteuse de ladite premiere voie de 
transmission sur ladite frequence porteuse de 
ladite seconde voie de transmission af in de re- 
cevoir ledit logiciel d'exploitation transmis sur 35 
ladite seconde voie de transmission. 
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